1 /** 2 * \file gcm.h 3 * 4 * \brief This file contains GCM definitions and functions. 5 * 6 * The Galois/Counter Mode (GCM) for 128-bit block ciphers is defined 7 * in <em>D. McGrew, J. Viega, The Galois/Counter Mode of Operation 8 * (GCM), Natl. Inst. Stand. Technol.</em> 9 * 10 * For more information on GCM, see <em>NIST SP 800-38D: Recommendation for 11 * Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC</em>. 12 * 13 */ 14 /* 15 * Copyright (C) 2006-2018, Arm Limited (or its affiliates), All Rights Reserved 16 * SPDX-License-Identifier: Apache-2.0 17 * 18 * Licensed under the Apache License, Version 2.0 (the "License"); you may 19 * not use this file except in compliance with the License. 20 * You may obtain a copy of the License at 21 * 22 * http://www.apache.org/licenses/LICENSE-2.0 23 * 24 * Unless required by applicable law or agreed to in writing, software 25 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 26 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 27 * See the License for the specific language governing permissions and 28 * limitations under the License. 29 * 30 * This file is part of Mbed TLS (https://tls.mbed.org) 31 */ 32 33 #ifndef MBEDTLS_GCM_H 34 #define MBEDTLS_GCM_H 35 36 #include "cipher.h" 37 38 #include <stdint.h> 39 40 #define MBEDTLS_GCM_ENCRYPT 1 41 #define MBEDTLS_GCM_DECRYPT 0 42 43 #define MBEDTLS_ERR_GCM_AUTH_FAILED -0x0012 /**< Authenticated decryption failed. */ 44 45 /* MBEDTLS_ERR_GCM_HW_ACCEL_FAILED is deprecated and should not be used. */ 46 #define MBEDTLS_ERR_GCM_HW_ACCEL_FAILED -0x0013 /**< GCM hardware accelerator failed. */ 47 48 #define MBEDTLS_ERR_GCM_BAD_INPUT -0x0014 /**< Bad input parameters to function. */ 49 50 #ifdef __cplusplus 51 extern "C" { 52 #endif 53 54 #if !defined(MBEDTLS_GCM_ALT) 55 56 /** 57 * \brief The GCM context structure. 58 */ 59 typedef struct mbedtls_gcm_context 60 { 61 mbedtls_cipher_context_t cipher_ctx; /*!< The cipher context used. */ 62 uint64_t HL[16]; /*!< Precalculated HTable low. */ 63 uint64_t HH[16]; /*!< Precalculated HTable high. */ 64 uint64_t len; /*!< The total length of the encrypted data. */ 65 uint64_t add_len; /*!< The total length of the additional data. */ 66 unsigned char base_ectr[16]; /*!< The first ECTR for tag. */ 67 unsigned char y[16]; /*!< The Y working value. */ 68 unsigned char buf[16]; /*!< The buf working value. */ 69 int mode; /*!< The operation to perform: 70 #MBEDTLS_GCM_ENCRYPT or 71 #MBEDTLS_GCM_DECRYPT. */ 72 } 73 mbedtls_gcm_context; 74 75 #else /* !MBEDTLS_GCM_ALT */ 76 #include "gcm_alt.h" 77 #endif /* !MBEDTLS_GCM_ALT */ 78 79 /** 80 * \brief This function initializes the specified GCM context, 81 * to make references valid, and prepares the context 82 * for mbedtls_gcm_setkey() or mbedtls_gcm_free(). 83 * 84 * The function does not bind the GCM context to a particular 85 * cipher, nor set the key. For this purpose, use 86 * mbedtls_gcm_setkey(). 87 * 88 * \param ctx The GCM context to initialize. This must not be \c NULL. 89 */ 90 void mbedtls_gcm_init( mbedtls_gcm_context *ctx ); 91 92 /** 93 * \brief This function associates a GCM context with a 94 * cipher algorithm and a key. 95 * 96 * \param ctx The GCM context. This must be initialized. 97 * \param cipher The 128-bit block cipher to use. 98 * \param key The encryption key. This must be a readable buffer of at 99 * least \p keybits bits. 100 * \param keybits The key size in bits. Valid options are: 101 * <ul><li>128 bits</li> 102 * <li>192 bits</li> 103 * <li>256 bits</li></ul> 104 * 105 * \return \c 0 on success. 106 * \return A cipher-specific error code on failure. 107 */ 108 int mbedtls_gcm_setkey( mbedtls_gcm_context *ctx, 109 mbedtls_cipher_id_t cipher, 110 const unsigned char *key, 111 unsigned int keybits ); 112 113 /** 114 * \brief This function performs GCM encryption or decryption of a buffer. 115 * 116 * \note For encryption, the output buffer can be the same as the 117 * input buffer. For decryption, the output buffer cannot be 118 * the same as input buffer. If the buffers overlap, the output 119 * buffer must trail at least 8 Bytes behind the input buffer. 120 * 121 * \warning When this function performs a decryption, it outputs the 122 * authentication tag and does not verify that the data is 123 * authentic. You should use this function to perform encryption 124 * only. For decryption, use mbedtls_gcm_auth_decrypt() instead. 125 * 126 * \param ctx The GCM context to use for encryption or decryption. This 127 * must be initialized. 128 * \param mode The operation to perform: 129 * - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. 130 * The ciphertext is written to \p output and the 131 * authentication tag is written to \p tag. 132 * - #MBEDTLS_GCM_DECRYPT to perform decryption. 133 * The plaintext is written to \p output and the 134 * authentication tag is written to \p tag. 135 * Note that this mode is not recommended, because it does 136 * not verify the authenticity of the data. For this reason, 137 * you should use mbedtls_gcm_auth_decrypt() instead of 138 * calling this function in decryption mode. 139 * \param length The length of the input data, which is equal to the length 140 * of the output data. 141 * \param iv The initialization vector. This must be a readable buffer of 142 * at least \p iv_len Bytes. 143 * \param iv_len The length of the IV. 144 * \param add The buffer holding the additional data. This must be of at 145 * least that size in Bytes. 146 * \param add_len The length of the additional data. 147 * \param input The buffer holding the input data. If \p length is greater 148 * than zero, this must be a readable buffer of at least that 149 * size in Bytes. 150 * \param output The buffer for holding the output data. If \p length is greater 151 * than zero, this must be a writable buffer of at least that 152 * size in Bytes. 153 * \param tag_len The length of the tag to generate. 154 * \param tag The buffer for holding the tag. This must be a readable 155 * buffer of at least \p tag_len Bytes. 156 * 157 * \return \c 0 if the encryption or decryption was performed 158 * successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, 159 * this does not indicate that the data is authentic. 160 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 161 * not valid or a cipher-specific error code if the encryption 162 * or decryption failed. 163 */ 164 int mbedtls_gcm_crypt_and_tag( mbedtls_gcm_context *ctx, 165 int mode, 166 size_t length, 167 const unsigned char *iv, 168 size_t iv_len, 169 const unsigned char *add, 170 size_t add_len, 171 const unsigned char *input, 172 unsigned char *output, 173 size_t tag_len, 174 unsigned char *tag ); 175 176 /** 177 * \brief This function performs a GCM authenticated decryption of a 178 * buffer. 179 * 180 * \note For decryption, the output buffer cannot be the same as 181 * input buffer. If the buffers overlap, the output buffer 182 * must trail at least 8 Bytes behind the input buffer. 183 * 184 * \param ctx The GCM context. This must be initialized. 185 * \param length The length of the ciphertext to decrypt, which is also 186 * the length of the decrypted plaintext. 187 * \param iv The initialization vector. This must be a readable buffer 188 * of at least \p iv_len Bytes. 189 * \param iv_len The length of the IV. 190 * \param add The buffer holding the additional data. This must be of at 191 * least that size in Bytes. 192 * \param add_len The length of the additional data. 193 * \param tag The buffer holding the tag to verify. This must be a 194 * readable buffer of at least \p tag_len Bytes. 195 * \param tag_len The length of the tag to verify. 196 * \param input The buffer holding the ciphertext. If \p length is greater 197 * than zero, this must be a readable buffer of at least that 198 * size. 199 * \param output The buffer for holding the decrypted plaintext. If \p length 200 * is greater than zero, this must be a writable buffer of at 201 * least that size. 202 * 203 * \return \c 0 if successful and authenticated. 204 * \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. 205 * \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are 206 * not valid or a cipher-specific error code if the decryption 207 * failed. 208 */ 209 int mbedtls_gcm_auth_decrypt( mbedtls_gcm_context *ctx, 210 size_t length, 211 const unsigned char *iv, 212 size_t iv_len, 213 const unsigned char *add, 214 size_t add_len, 215 const unsigned char *tag, 216 size_t tag_len, 217 const unsigned char *input, 218 unsigned char *output ); 219 220 /** 221 * \brief This function starts a GCM encryption or decryption 222 * operation. 223 * 224 * \param ctx The GCM context. This must be initialized. 225 * \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or 226 * #MBEDTLS_GCM_DECRYPT. 227 * \param iv The initialization vector. This must be a readable buffer of 228 * at least \p iv_len Bytes. 229 * \param iv_len The length of the IV. 230 * \param add The buffer holding the additional data, or \c NULL 231 * if \p add_len is \c 0. 232 * \param add_len The length of the additional data. If \c 0, 233 * \p add may be \c NULL. 234 * 235 * \return \c 0 on success. 236 */ 237 int mbedtls_gcm_starts( mbedtls_gcm_context *ctx, 238 int mode, 239 const unsigned char *iv, 240 size_t iv_len, 241 const unsigned char *add, 242 size_t add_len ); 243 244 /** 245 * \brief This function feeds an input buffer into an ongoing GCM 246 * encryption or decryption operation. 247 * 248 * ` The function expects input to be a multiple of 16 249 * Bytes. Only the last call before calling 250 * mbedtls_gcm_finish() can be less than 16 Bytes. 251 * 252 * \note For decryption, the output buffer cannot be the same as 253 * input buffer. If the buffers overlap, the output buffer 254 * must trail at least 8 Bytes behind the input buffer. 255 * 256 * \param ctx The GCM context. This must be initialized. 257 * \param length The length of the input data. This must be a multiple of 258 * 16 except in the last call before mbedtls_gcm_finish(). 259 * \param input The buffer holding the input data. If \p length is greater 260 * than zero, this must be a readable buffer of at least that 261 * size in Bytes. 262 * \param output The buffer for holding the output data. If \p length is 263 * greater than zero, this must be a writable buffer of at 264 * least that size in Bytes. 265 * 266 * \return \c 0 on success. 267 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 268 */ 269 int mbedtls_gcm_update( mbedtls_gcm_context *ctx, 270 size_t length, 271 const unsigned char *input, 272 unsigned char *output ); 273 274 /** 275 * \brief This function finishes the GCM operation and generates 276 * the authentication tag. 277 * 278 * It wraps up the GCM stream, and generates the 279 * tag. The tag can have a maximum length of 16 Bytes. 280 * 281 * \param ctx The GCM context. This must be initialized. 282 * \param tag The buffer for holding the tag. This must be a readable 283 * buffer of at least \p tag_len Bytes. 284 * \param tag_len The length of the tag to generate. This must be at least 285 * four. 286 * 287 * \return \c 0 on success. 288 * \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure. 289 */ 290 int mbedtls_gcm_finish( mbedtls_gcm_context *ctx, 291 unsigned char *tag, 292 size_t tag_len ); 293 294 /** 295 * \brief This function clears a GCM context and the underlying 296 * cipher sub-context. 297 * 298 * \param ctx The GCM context to clear. If this is \c NULL, the call has 299 * no effect. Otherwise, this must be initialized. 300 */ 301 void mbedtls_gcm_free( mbedtls_gcm_context *ctx ); 302 303 /** 304 * \brief The GCM checkup routine. 305 * 306 * \return \c 0 on success. 307 * \return \c 1 on failure. 308 */ 309 int mbedtls_gcm_self_test( int verbose ); 310 311 #ifdef __cplusplus 312 } 313 #endif 314 315 316 #endif /* gcm.h */ 317